The DPDP Act and verification APIs: what actually changes for you
The Digital Personal Data Protection Act reshapes how you collect and use identity data. A practical read for teams running verification.
On this page
Purpose limitation is the big one
Under the DPDP Act you must have a specific, lawful purpose for every piece of personal data you process, including the PAN, Aadhaar reference, or bank name a verification returns. "We might need it later" is not a purpose. Tie every check to a named use: onboarding this customer, paying this vendor, resolving this dispute.
In practice this means logging the purpose and the case id with every API call, and being able to produce that log.
Consent and notice
Collect consent for identity verification at the point of collection, in plain language, separate from a wall of terms. The notice should say what you will check, against which sources, and how long you will keep the result.
Retention and deletion
Keep verification results only as long as the purpose and any statutory retention requires. Build a deletion job. When a user closes their account, their verification records should age out on a defined schedule, not sit forever.
Data minimisation in the response
Store the fields you actually use for the decision and the audit, not the entire raw payload if you do not need it. If you only need pass or fail and the matched name, do not warehouse the date of birth.